fantasty[.]coinity[.]site

PhishDestroy identifies fantasty.coinity.site as an active credential harvesting domain leveraging a spoofed login interface to target cryptocurrency users. The domain mimics legitimate services to deceive victims into surrendering wallet credentials or seed phrases. No known drainer kit or brand association is currently documented, suggesting a generic but evolving phishing campaign designed to harvest high-value account access.

This domain resolves to IP 78.159.119.244 and was registered through Atak Domain Bilgi Teknolojileri A.Ş. on April 05, 2025. The site holds a valid Let’s Encrypt SSL certificate, which may increase user trust despite its malicious intent. VirusTotal detection stands at 1/95 security vendors as of seed 03ae3f, indicating low but present recognition within the security community. The domain remains unlisted in Google Safe Browsing (GSB) and shows no blocklist entries beyond this isolated detection, suggesting a recently deployed threat with limited exposure.

The domain remains active and poses an elevated risk due to its plausible appearance and crypto-focused lures. Users are advised to block access, refrain from interacting with the site, and report the domain to threat intelligence platforms. While current risk is elevated, the limited detection footprint and lack of widespread blocklisting indicate that proactive blocking and user awareness remain the most effective defenses. Remaining risk is moderate due to the potential for rapid expansion or payload changes.